Tag Archive for IPv6

IPv4 IPocalypse Strikes Europe

IPv6The IPocalypse has stuck Europe. RIPE NCC, the Regional Internet Registry (RIR) for Europe, the Middle East and parts of Central Asia announced on 09-14-12 that it is down to its last “/8″ worth of IPv4 addresses. ArsTechnica reports it is no longer possible to get new IPv4 addresses in Europe, the former USSR, or the Middle East, with one small exception: every network operator that is a “RIPE member” or “local Internet registry” (LIR) can get one last block of 1024 IPv4 addresses. To fulfill these requests, the RIPE NCC is keeping that last /8, which has 16.8 million addresses, in reserve.

Europe officially runs out of IPv4 addresses

IPocalypseNone of this comes as a surprise, according to the author, given that global IPv4 IPocalypse struck when the global pool of free IPv4 addresses dried up in February 2011. APNIC, which distributes IP addresses in the Asia-Pacific region, ran out of IPv4 addresses in May 2011. The remaining three Regional Internet Registries are AfriNIC (Africa), LACNIC (Latin America and the Caribbean), and ARIN (North America), which all have enough IPv4 addresses to last at least two more years.

Since the depletion of IPv4 address space in the APNIC region, little information has surfaced about how network operators in the region have managed the situation. The article states, the lack of IPv4 addresses only impacts organizations and consumers who need more addresses, or who need addresses for the first time. Existing IPv4 users remain unaffected by the global IPocalypse, and so the immediate impact is limited. Also, large network operators get large address blocks from the RIRs and they typically have a pool of unused addresses of their own, so few will be experiencing immediate problems.

Dont worryEvery year for the past five years, some 200 million new IPv4 addresses have been put into use. Ars cautions, without a steady supply of fresh addresses, many Internet-related activities are going to become problematic in the years to come. Fortunately, 20 years ago the Internet Engineering Task Force (IETF) foresaw the IPv4 IPocalypse, where the 3.7 billion 32-bit IPv4 addresses would run out, would become a problem, and started working on a replacement: IPv6. However, the IPv4 depletion didn’t happen as fast as the IETF originally predicted, and IPv6 adoption has languished.

rb-

World IPv6 launchSo IPv6 adoption got a big kick in the implementation from World IPv6 Launch. Eventually, IPv6 will replace IPv4, but the transition won’t be pretty. I have covered some of the IPv6 issues here, here and here. Give it some time, Europe and the rest of us will survive the IPv4 IPocalypse.

Privacy on IPv6 Networks

security and privacyInternet service providers, web sites, and equipment vendors around the globe took part in the World IPv6 launch in June, Internet companies including AT&T (T), Cisco (CSCO), Comcast (CMCSA), Facebook (FB), Google (GOOG), Microsoft (MSFT), Verizon Wireless (VZ), and Yahoo (YHOO) decided to permanently turn on IPv6. A small fraction of Internet users and devices have started communicating via IPv6 networks, with more and more transitioning to the new protocol over the coming months and years. There are security and privacy implications in the switch to IPv6.

Privacy on IPv6 networksAll kinds of devices will get new IPv6 numbers as the addressing format grows. The IPv6 addresses for these networked devices can be generated in a number of different ways and the choice of how they are created has potentially wide-reaching effects for security and privacy Center for Democracy & Technology explains. One of the original methods for assigning new addresses involved using a unique device identifier (known as a MAC address) as the suffix of the IPv6 address. This method creates a permanent, unique address for a device, potentially allowing any server that the device communicates with to indefinitely track the user.

IPv6 designers soon realized the potential security and privacy problems of MAC-based addresses; as a result, they created an alternate method known as “privacy extensions” or “privacy addresses” the article reports. The privacy extensions use a randomly generated number instead of a MAC address. In order to protect privacy on an IPv6 network, the random number is unrelated to any device identifier and in practice lasts no more than a week (and often much less time), ensuring that the user’s IP address cannot be used for long-term user tracking.

SmarrtphoneIt is up to operating system vendors to choose which IP address assignment method will be the default on their devices. The author says that some vendors have made good choices, particularly within the last year. Microsoft has long led the charge on IPv6 privacy, with privacy extensions on by default in all versions of Microsoft Windows since the release of Windows XP nearly a decade ago. Apple followed suit last year, with privacy extensions activated by default in all versions of Mac OS X since 10.7 (Lion) and with the release of iOS 4.3 for iPhone and iPad. Google did likewise in its Android 4.0 release last year.

The CDT says that as long as Internet users choose to upgrade their operating systems to the latest versions, they should be protected against perpetual security and privacy threats from IPv6 network address tracking.

rb-

Security and privacy on IPv6 networkHowever, I wrote about reports from H  Security that mobile operating systems do not protect security or privacy on IPv6 networks. The report says mobile OS’s send private information about their users to the network. The H.Security article says this is not a flaw in IPv6, rather it is lazy programming in some cases. The article points out that neither Apple’s iOS nor Android devices have the option to enable Privacy Extensions or the option to disable IPv6. apparently the only thing the smartphones need is a control option in the user interface to protect mobile OS users privacy and security on an IPv6 network.

 

IPv6 Compromise Smartphones Users’ Privacy

IPv6Now that the IPv4 address pool is depleted and the IPocalypse is at hand, wrinkles are emerging in IPv6.  One of the wrinkles is with mobile devices. Most of the cool mobiles devices have been able to handle IPv6 for a while. Apple’s (AAPL) iPhones, iPads and iPods have been capable of handling IPv6 Since version 4 of the iOS operating system and most Google (GOOG) Android devices have been capable since version 2.1. H  Security is reporting that these mobile operating systems send information about their users to the network.

A device on an IPv6 network usually determines half of theirSmartphone risks address (the “interface identifier”) themselves, but H Security says that smartphones are sloppy with this task. According to the article, the smartphones simply add the same two bytes to their globally unique MAC address and use it as their identifier. As a result, they transfer a unique hardware ID whenever they communicate with an IPv6-enabled server.

The basic problem isn’t an IPv6 issue because there are other methods for generating the address. The article says that a device can generate a random interface identifier and replace it on a regular basis. This is called Privacy Extensions method and is the factory-set option in Windows; it can also be enabled in other operating systems. The article points out that devices running Apple’s iOS or Android offer neither the option to enable Privacy Extensions nor the option to disable IPv6, anyone who uses an affected device on an IPv6-enabled wireless network will send their ID.

IPocalypseThe only thing the smartphones are lacking is a control option in the user interface, as the Privacy Extensions do come as part of their kernel. For instance, on a (jailbroken) iOS 4 device with root access, they can be enabled with the same command that enables them on a desktop device running Mac OS X:

sysctl -w net.inet6.ip6.use_tempaddr=1

The blog claims the problem is only affecting a small number of users because IPv6 is not yet in widespread use. However, more ISPs plan to offer IPv6 in addition to the old IPv4 in the future. In addition, there are routers like the Cisco (CSCO) Linksys E3000, which will, automatically set up an IPv6 connection via a 6to4 conversion when their internet access is purely IPv4.

The author concludes that the issue is particularly sensitive because such devices tend to be used by one specific person. As a result, the MAC address, which is accessible to any server operator and network monitor, allows this user to be identified.

rb-

If this sounds familiar, it is I wrote about mobile apps uploading  UDID’s here.

Security Considerations for IPv6

World IPv6 DayFor those who missed the announcement from the Internet Society (ISOC) World IPv6 Launch day arrived on June 6. (I blogged about World IPv6 day, back in March.)  Carl Herberger, VP Security at Radware (RDWR) recently wrote at Help Net Security that he sees World IPv6 Launch day as much more hype than an operational change.

Internet SocietyMany high-profile organizations like Google (GOOG), Facebook (FB), Microsoft (MSFT) Bing, Yahoo (YHOO) and Akamai (AKAM) have hooked their plans on change over to the ISOC launch date, Mr. Herberger points out that many companies have already leveraged IPv6 WAN connectivity. Most mobile providers who have adopted LTE 4G infrastructures have built for mobile devices, which connect to the Internet with IPv6 addresses, default. He argues that since a 4G phone must also be 3G and IPv4 compatible all the 5G providers have done, and much to the chagrin of the initial designers, is to have woven IPv6 into the existing IPv4 Internet.

Bottom line: Because IPv4 is not going away any time soon, we will essentially live in perpetuity with both designs. A new dawn? Or the beginning of the end? The Radware VP thinks it’s neither, he calls the interoperability issues between IPv4 and IPv6, a Pandora’s Box of opportunity for those of the nefarious persuasion.

So, what are the three main takeaways from World IPv6 Launch day?

Take away #1: IPv6 will first be implemented on the WAN, IPv4 will continue to remain in the LAN for years to come – Google, Facebook, DNS, CDN providers and many, if not most ISP’s are all moving to default IPv6 WAN cDog and catonnectivity. However, nearly no one has made the transition to IPv6 on the LAN. Mr. Herberger adds that rapid IPv6 deployment on the Internet WAN operations side, and the very slow rollout of IPv6 on the LAN side will wreak havoc on perimeter security. He believes that there are huge problems associated with IPv4 and IPv6 cohabitating.

Take away #2: IPv6 & IPv4 don’t cohabitate well – IPv6 and IPv4 make insecure bedfellows. There are no predefined standards in the way to handle the cohabitation of IPv4 with IPv6.  The transition mechanisms to facilitate the transitioning of the Internet from its first IPv4 infrastructure to IPv6 have not standardized yet. The Internet Engineering Task Force (IETF) has working groups and discussions through the IETF Internet Drafts and Requests for Comments processes to develop these methods. Some basic IPv6 transition mechanisms have been defined; however nothing has yet emerged as a proposed uniform standard. As such, the article states, the world is awash with a plethora of IPv4 to IPv6 (and vice versa) Transition Mechanisms such as:

  • Encapsulating IPv4 in IPv6 (or 4in6)
  • Encapsulating IPv6 in IPv4 (or 6in4)IPv6 tunnel
  • IPv6 over IPv4 (6over4)
  • DS-Lite
  • 6rd
  • 6to4
  • ISATAP
  • NAT64 / DNS64
  • Teredo
  • SIIT.
If you are familiar with network perimeter security devices, one of the things they do well is deep packet inspection and Stateful aware analysis. However, some of the dirty little secrets is that nearly none of today’s technologies have a capability to inspect encrypted traffic such as SSL  or the ability to inspect tunneling protocols such as L2TP, PPTP, etc. What IPv4 and IPv6 transition does is effectively exacerbate these “Achilles heels” in security detection capabilities by introducing a whole new class of nearly undetectable transmissions. The author warns Don’t be fooled by a vendor’s claim that they inspect a v4 packet in v6 or vice versa, because even if true for one or two methodologies, the ways to carry out this task are almost immeasurable today. This is really a true community-wide problem and one that must be addressed.
ConfusedTake away #3: Meet your old vulnerability – Same as the new vulnerability! Much of our defense is single threaded, and should an adversary be able to pass through your perimeter defenses, many of the ‘older’ vulnerabilities would find a receptive home having passed through the ‘corporate scrubbers.’Moreover, just think of the new opportunities available to more nefarious organizations that don’t have your interests in mind. This ‘transition mechanism’ essentially becomes an effective ‘unscrubbed’ gateway or tunnel for all newly developed organized crime-designed, state-sponsored, and Hacktivist-motivated attacks.

Moreover, most of us will be largely blind to these realities unless you are acting now to make certain that your gateways are designed with all encapsulated traffic being detected and mitigated. Anomaly detection takes center stage here and signature tools will leave you wanting.

The Radware VP concludes that this problem requires action on behalf of security professionals to solve; you HAVE to do something differently because the inertia path will leave you vulnerable.

Internet of Things

Council imagines the Internet of Things as a world where everything can be both analog and digitally approached. It reformulate our relationship with objects – things- as well as the objects themselves.  Any object that carries an RFID tag relates not only to you, but also through being read by a RFID reader nearby, to other objects, relations or values in a database. In this world, you are no longer alone, anywhere.

The Machines Are Talking a Lot

Machine ti machine communication Cisco’s Visual Networking Index Global Mobile Data Traffic Forecast Update, 2011-2016 reports that Internet traffic continues to grow at unprecedented rates. Cisco says that the second leading source of internet traffic will be machines.

The networking giant says the source will be from machine-to-machine communications, or “M2M.” Brian Bergstein at MIT‘s Technology Review says to think of sensors in cars and in appliances, surveillance cameras, smart electric meters, and devices still to come, monitoring the world and reporting to Macnine to machine communicationseach other and to centralized computers what they’re detecting. The chart below, reprinted from the Cisco report, shows just how extreme the jump in machine-to-machine communications could be. Cisco says M2M will grow, on average, 86 percent a year, reaching 508 petabytes a month, or half a billion gigabytes by 2016 .

Here comes a hot new chip for Internet of things

ARM ARM (ARMH), the semiconductor company whose chip technology powers most modern smartphones, has come up with a chip for the Internet of things (IoT). Om Malik at GigaOM reports that the Cortex-M0+ is an energy-efficient chip, optimized for use in everything from connected lighting to power controls to other home appliances. In a press release, the company explains:

The 32-bit Cortex-M0+ processor … consumes just 9µA/MHz … around one-third of the energy of any 8 or 16-bit processor available today, while delivering significantly higher performance …[to] enable the creation of smart, low-power microcontrollers to provide … wirelessly connected devices, a concept known as the ‘Internet of Things.’

At GigaOM’s Mobilize 2011 event ThingM CEO Mike Kuniavsky said that “ubiquitous network connectivity, cloud-based services, cheap assembly of electronics, social design, open collaboration tools and low-volume sales channels create an innovation ecosystem that is the foundation for an Internet of things.”

GigaOM says Freescale and NXP (NXPI), both are major suppliers to the automotive and home automation industries have signed up for the new ARM chip technology. Freescale and NXP have locations in the Farmington Hills, MI area.

And another new chip for smart homes & appliances

Qualcomm Atheros Internet of Things at GigaOm recently noted that Atheros, a division of Qualcomm (QCOM) launched a new very low power consuming Wi-Fi chip, AR4100P, focused on the “Internet of Things.” He predicts that soon, there might be Wi-Fi in everything around us, including Samsung’s (005930) Wi-Fi enabled washing machines, which Malik wrote about earlier.

According to the blog, the new “highly integrated 802.11n single-stream Wi-Fi system-in-package with integrated dual IPv4 IPv6 networking stack” is focused on smart home and building controls and appliances. Atheros and other chip companies such as ARM are betting that the Internet of Things will prove to be a new giant market opportunity.

rb-

The new Atheros chip also includes an IPv6 stack as well as 802.11n to give end-to-end control of your home appliances.

The Web Connected Smelly Robot

Olly The web connected smelly robotThe Internet of Things now has smell-o-vision from Olly. Olly takes services on the Internet and delivers their pings as smell according to his web-site. Whether it’s tweets, a like on Instagram, Olly will be sure to let your nose know about it. Mint Foundry, a graduate design lab at Mint Digital dedicated to exploring the potential of web-connected objects developed Olly.

It is possible to change Olly’s smells in an instant. It has a removable section in the back which can be filled with any smell you like. It could be essential oils, a slice of fruit, your partner’s perfume or even a drop of gin.

Olly is stackable, so if you have more than one, you can assign each one to a different service with a different smell. Connect one to Twitter and another to your calendar. Before you know it, you’ll have a networked Internet smell center claims the web-site.
Olly is not yet in production, but Mint is glad to offer the source files to anyone who’s got a 3D printer and a nose for adventure.

Switch to our mobile site